tests: add script to update FIPS image in test-fips workflow

.github/workflows/test-fips.yml

@@ -21,7 +21,7 @@ jobs:
     # https://docs.github.com/en/actions/writing-workflows/choosing-where-your-workflow-runs/running-jobs-in-a-container
     # docker run -it --rm --name fipsy docker.elastic.co/wolfi/chainguard-base-fips:latest
     container:
-      image: docker.elastic.co/wolfi/chainguard-base-fips:latest@sha256:60d2da332337ed2252d3ad06d0b51416adf72448e61215103e9e73657dff63a9
+      image: docker.elastic.co/wolfi/chainguard-base-fips:latest@sha256:091dcf0eab7fc666cc929adbb52c6e1d6692c4b52f7f0a15905a9ad48960dbd6
       credentials:
         username: ${{ secrets.ELASTIC_DOCKER_USERNAME }}
         password: ${{ secrets.ELASTIC_DOCKER_PASSWORD }}

dev-utils/update-fips-image.js

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+
+/*
+ * Copyright Elasticsearch B.V. and other contributors where applicable.
+ * Licensed under the BSD 2-Clause License; you may not use this file except in
+ * compliance with the BSD 2-Clause License.
+ */
+
+'use strict';
+
+// Update the wolfi image for testing with FIPS in the `test-fips.yml` workflow file.
+// Assumes docker daemon is installed and running
+//
+// Usage:
+//      node dev-utils/update-fips-image.js
+
+const { execSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+const TOP = path.resolve(__dirname, '..');
+const file = path.resolve(TOP, '.github', 'workflows', 'test-fips.yml');
+
+// ---- mainline
+
+function main() {
+  // We should replace any reference to the fips image in the yml
+  // file. It's easy to detect since it has the form
+  // ```
+  // image: docker.elastic.co/wolfi/chainguard-base-fips:latest@sha256:SHA_VALUE
+  // ```
+  // So checking for a substring maybe is enough. We will replace that line for a
+  // new one.
+  const imageRef = 'docker.elastic.co/wolfi/chainguard-base-fips:latest';
+
+  // Get the latest and extract the SHA
+  const out = execSync(`docker image pull ${imageRef}`, { encoding: 'utf-8' });
+  let sha256;
+  for (const line of out.split('\n')) {
+    if (line.startsWith('Digest: ')) {
+      sha256 = line.slice(8);
+    }
+  }
+  console.log('Latest FIPS image sha256 is', sha256);
+
+  // Read the file content and replace any reference to the FIPS image
+  const content = fs.readFileSync(file, { encoding: 'utf-8' }).split('\n');
+  const search = `image: ${imageRef}@sha256:`;
+  let shouldUpdate = false;
+
+  for (let i = 0; i < content.length; i++) {
+    const line = content[i];
+    const isImageLine = line.indexOf(search) !== -1;
+    const isShaOutdated = isImageLine && line.indexOf(sha256) === -1;
+
+    if (isImageLine && isShaOutdated) {
+      console.log('Found FIPS image with outdated sha256. Updating');
+      shouldUpdate = true;
+      content[i] = line.replace(/image:.+/, `image: ${imageRef}@${sha256}`);
+    }
+  }
+
+  if (shouldUpdate) {
+    fs.writeFileSync(file, content.join('\n'), { encoding: 'utf-8' });
+  } else {
+    console.log('No outdated FIPS images found.');
+  }
+}
+
+if (require.main === module) {
+  main();
+}